772ac721b0
docs(P52): create v1.10 milestone plan — pipeline regression fix + capability re-verification
...
---ci---
project: acdl
phase: 52
milestone: v1.10
status: plan
decisions: [D-090, D-091, D-092, D-093, D-094]
requirements: [REQ-112, REQ-113, REQ-114, REQ-115]
---/ci---
2026-07-27 17:10:09 +00:00
58100c485e
docs(P00): create 5 phase plans for v1.9 (phases 39-43)
...
---ci---
project: acdl
phase: 0
milestone: v1.9
status: plan
---/ci---
5 vertical-slice phases, wave-ordered:
- Wave 1 (parallel): Phase 39 (design docs + P1-1, disjoint file sets)
- Wave 2: Phase 40 (contract interpolation + env schema)
- Wave 3: Phase 41 (per-env CI jobs + env workflow input)
- Wave 4: Phase 42 (stubs: SoD, HITL gates, attestation matrix, Wiz, Kyverno)
- Wave 5: Phase 43 (verify + review + audit + complete)
Plans reference REQ-100..REQ-111. Decisions D-080..D-089 applied.
Versioning: feature milestone, patches v1.8.1..v1.8.5, tag v1.9.0 at COMPLETE.
2026-07-23 04:19:17 +00:00
045c7279aa
docs(P28-38): create 11 phase plans for v1.8
...
---ci---
project: acdl
phase: 28-38
milestone: v1.8
status: plan
---/ci---
11 phase plans created covering 24 requirements (REQ-76..99):
P28: adapter WAF + resolver outputs (P1-4,5,7)
P29: SSM KMS + invoke policy (P1-3,6)
P30: run-platform isolation + API portability + S1 (P1-8,9,S1)
P31: encryption-by-default + per-stack CMK
P32: deletion-protection-by-default + L2 feature flag
P33: uptime-kuma primitive + pipeline stage
P34: decommission alias + CMDB validation
P35: module engineering standards
P36: schemas/adapters/pipelines READMEs
P37: verify (4-layer)
P38: review-audit-complete
2026-07-22 22:02:09 +00:00
64d35c78e6
docs(P16): plan-as-execute + verify (v1.2.6, capstone)
...
---ci---
project: acdl
phase: 16
milestone: v1.2
status: verify
verdict: VERIFIED
requirements:
covered: [REQ-35]
partial: []
blocker:
- P0-IAM: terraform apply blocked; operator must push spike_runner_policy.json (carried from Phase 15)
---/ci---
Phase 16 plan-as-execute + verify. scripts/verify_phase16.sh green (11
assertions). Capstone: full v1.2 platform verified end-to-end up to the
IAM-blocked terraform apply. MILESTONE_CAPSTONE_VERIFIED evidence event
written to outbox. v1.1 S3 regression passes. Ready to ship v1.2.6 +
enter the COMPLETE gate.
2026-07-21 22:24:20 +00:00
699aa542df
docs(P15): plan-as-execute + verify (v1.2.5, PARTIAL — terraform apply blocked by IAM)
...
---ci---
project: acdl
phase: 15
milestone: v1.2
status: verify
verdict: PARTIAL
requirements:
covered: [REQ-34]
partial: [REQ-33]
blocker:
- id: P0-IAM
description: terraform apply fails with AccessDenied on ECS/ECR/IAM/EC2 — live spike_runner_policy.json not pushed (root key deactivated per D-034)
unblock: operator runs create_iam_user.py with root/admin creds to push the expanded policy, then terraform apply succeeds (plan valid, 13 to add)
---/ci---
Phase 15 plan-as-execute + verify. PARTIAL: terraform apply blocked by IAM.
- Consumer microservice content authored (app.py + Dockerfile + README.md).
- Docker image acdl-microservice:latest built.
- Adapter fixed: ref emission (bare), JSON-string jsonencode, ECS service
network_configuration/load_balancer/desired_count/launch_type/task_definition,
listener default_action/load_balancer_arn, target group target_type/vpc_id/protocol,
VPC tags (not name), IGW + route table association, managed_policy_arns list.
- L1 fixes: l1-ecs-service (removed port from service sub-resource),
l1-vpc (added intra_refs, removed igw_id output).
- Resolver: intra_refs resolution (refs between sub-resources of same L1).
- terraform validate + plan succeed (13 to add).
- terraform apply BLOCKED (AccessDenied — live IAM policy not updated).
- Evidence event TERRAFORM_APPLY_BLOCKED written to DynamoDB outbox.
- v1.1 S3 regression: byte-identical.
Ready to ship v1.2.5 (partial).
2026-07-21 22:21:36 +00:00
d103a37419
docs(P14): plan-as-execute + verify (v1.2.4)
...
---ci---
project: acdl
phase: 14
milestone: v1.2
status: verify
verdict: VERIFIED
requirements:
covered: [REQ-32]
---/ci---
Phase 14 plan-as-execute + verify. scripts/verify_phase14.sh green.
l2-microservice composition (6 L1s, 2 wire kinds); contract schema
extended (inputs allow objects + healthcheck); resolver extended
(array-form wires, child->child refs, multi-resource L1 expansion);
adapter extended (ref: interpolation translation). v1.2 IR: 11 resources.
v1.1 S3 regression byte-identical. Ready to ship v1.2.4.
2026-07-21 21:12:17 +00:00
4ed2542ecf
docs(P13): plan-as-execute + verify (v1.2.3)
...
---ci---
project: acdl
phase: 13
milestone: v1.2
status: verify
verdict: VERIFIED
requirements:
covered: [REQ-31]
---/ci---
Phase 13 plan-as-execute + verify. scripts/verify_phase13.sh green.
6 ECS L1s authored + registered (l1-vpc, l1-ecs-cluster, l1-ecs-service,
l1-iam-role, l1-alb, l1-ecr). Adapter generalized to table-driven
TYPE_MAP (12 IR types) + INPUT_MAP + OUTPUT_MAP. S3 regression: the v1.1
spike l1-s3 produces byte-identical main.tf. Ready to ship v1.2.3.
2026-07-21 21:05:48 +00:00
0fea29cdbb
docs(P12): plan-as-execute + verify (v1.2.2)
...
---ci---
project: acdl
phase: 12
milestone: v1.2
status: verify
verdict: VERIFIED
requirements:
covered: [REQ-30]
---/ci---
Phase 12 plan-as-execute + verify. scripts/verify_phase12.sh green (22
assertions). All Wave 1 + Wave 2 tasks complete:
- T-12.1: run_spike_*.sh -> run_platform.sh (D-048, --plan-only flag)
- T-12.2: spike_runner_policy.json expanded (ECS + ECR + ELB + IAM + EC2)
- T-12.3: idempotency documented in bootstrap scripts
- T-12.4: P1-1 redacted (no live AWS key IDs in .ciagent/)
- T-12.5: P1-B fixed (PERSONAS.md platform/registry -> modules-ir/registry.json)
Subagent confirmed run_platform.sh --plan-only runs against real AWS, exit 0.
Ready to ship v1.2.2.
2026-07-21 21:01:51 +00:00
81c6e3995e
docs(P11): plan + verify + verify_phase11.sh (v1.2.1)
...
---ci---
project: acdl
phase: 11
milestone: v1.2
status: verify
verdict: VERIFIED
requirements:
covered: [REQ-29]
---/ci---
Phase 11 plan-as-execute + verify. scripts/verify_phase11.sh green (24
assertions). Plan + VERIFY committed. Ready to ship v1.2.1.
2026-07-21 20:57:45 +00:00
cc4c27c8ab
docs(P10): create Phase 10 plan (v1-spike-l2-and-contract-e2e)
...
---ci---
project: acdl
phase: 10
milestone: v1.1
status: plan
plan:
waves: 5
tasks: 9
requirements: [REQ-25, REQ-27, REQ-28]
---/ci---
Phase 10 plan (milestone capstone). 5 waves, 9 files:
- Wave 1 (platform): L2 composition + registry + adapter L2 extension (D-P10-1)
- Wave 2 (backend): contract spike.yaml + contract_resolver.py + outbox_writer.py
- Wave 3 (backend+security+platform): run_spike_e2e.sh (10-step pipeline)
- Wave 4 (lead): verify_phase10.sh (incl. REQ-28 substrate-agnostic grep)
- Wave 5 (EXECUTE-only): run e2e against real AWS + verify + ship
Key decisions: D-P10-1 (adapter consumes resolved IR instance; L2 root
module = L1 resource for depth-1), D-P10-2 (YAML contract + JSON Schema
validation), D-P10-3 (single CONFIDENCE_COMPUTED event; GENESIS chain).
REQ-28 binding claim: only adapters/ files contain aws_s3_bucket / aws_
Terraform-specific terms; modules-ir/ schemas/ contracts/ acdl_platform/
are substrate-agnostic.
2026-07-21 19:31:42 +00:00
327ba1de75
docs(P09): create Phase 09 plan (v1-spike-ir-and-l1-and-adapter)
...
---ci---
project: acdl
phase: 9
milestone: v1.1
status: plan
plan:
waves: 5
tasks: 9
requirements: [REQ-24, REQ-26]
---/ci---
Phase 09 plan authored by ci-planner. 5 waves, 9 files:
- Wave 1 (platform): T-9.1 interface.json, T-9.2 spike_instance.json,
T-9.3 registry.json, T-9.4 README.md (parallel)
- Wave 2 (platform): T-9.5 adapters/terraform/adapter.py
- Wave 3 (platform): T-9.6 generated terraform/spike/*.tf, T-9.7
run_spike_plan.sh, T-9.9 .gitignore (parallel)
- Wave 4 (lead): T-9.8 verify_phase09.sh
- Wave 5 (lead, EXECUTE-only): run real terraform plan + verify + tag
Key decisions:
- D-P09-1: spike runs terraform plan -lock=false (outbox table PK is
contractId not LockID; plan-only doesn't write state; v1.2 creates
proper acdl-tflock table)
- D-P09-2: interface.json (typed contract) vs spike_instance.json (IR-
schema-valid instance) - cleanly separates declaration from
materialization (resolved the IR schema's inputs-are-values friction)
- D-P09-3: registry at modules-ir/registry.json (co-located with L1s)
- D-P09-4: generated TF committed + verify regenerates into temp + diffs
2026-07-21 19:11:37 +00:00
a003168b3a
docs(P08): create Phase 08 plan (aws-bootstrap)
...
---ci---
project: acdl
phase: 8
milestone: v1.1
status: plan
plan:
waves: 5
tasks: 8
requirements: [REQ-23]
---/ci---
Phase 08 plan authored by ci-planner. 5 waves:
- Wave 1 (security): T-8.1 spike_runner_policy.json (least-privilege)
- Wave 2 (platform): T-8.2/T-8.3 create_state_backend.py, T-8.4 create_iam_user.py
- Wave 3 (platform): T-8.5 rotate_spike_key.sh
- Wave 4 (lead): T-8.6 verify_phase08.sh, T-8.7 README + .gitignore
- Wave 5 (lead, EXECUTE-only): T-8.8 run bootstrap against AWS + D-034 closure
7 authored files. Key decisions: D-P08-1 (one DynamoDB table acdl-outbox
for both lock + outbox), D-P08-2 (IAM user acdl-spike-runner not OIDC
role; OIDC deferred to v1.2 per D-039), D-P08-3 (Wave 5 EXECUTE-only),
D-P08-4 (optional Gitea secret upload), D-P08-5 (initial key is
throwaway).
Security: root key via env vars only (never committed); .env.secrets
gitignored; IAM policy explicit Deny-everything-else; D-034 closure =
user manually rotates root key post-phase.
2026-07-21 18:57:31 +00:00
b40aadd195
docs(P07): create Phase 07 plan (architecture-v1-finalization)
...
---ci---
project: acdl
phase: 7
milestone: v1.1
status: plan
plan:
waves: 5
tasks: 10
requirements: [REQ-16, REQ-17, REQ-18, REQ-19, REQ-20, REQ-21, REQ-22]
---/ci---
Phase 07 plan authored by ci-planner. 5 waves (strictly ordered):
- Wave 1 (lead-developer): REQ-16 architecture-v1.0.md snapshot (umbrella)
- Wave 2 (platform + backend parallel): REQ-17 ir.schema.json || REQ-22 contract.schema.json
- Wave 3 (security-engineer, 5 files): REQ-18 PolicyCheckResult schema + checkov_adapter.py, REQ-20 audit_ledger_design.md, REQ-21 hitl_matrix_design.md + separation_of_duties.py
- Wave 4 (backend + security co-authored): REQ-19 confidence_signal.py (depends on Wave 3)
- Wave 5 (lead-developer): verify_phase07.sh + traceability
9 deliverable files + 1 verify script. Cross-persona co-authorship on
confidence_signal.py (backend weighted-sum + security penalty mapping)
mitigated by the PLAN content checklist fixing the critical-override
sentinel + short-circuit location.
2026-07-21 18:40:20 +00:00
b927f9026a
docs(P06): create Phase 06 plan (archive-demo-and-reorient)
...
---ci---
project: acdl
phase: 6
milestone: v1.1
status: plan
plan:
waves: 3
tasks: 6
requirements: [] # repo hygiene; no new REQ
---/ci---
Phase 06 plan authored by ci-planner. 3 waves (strictly ordered):
- Wave 1 (lead-developer): T-6.1 git mv demo dirs, T-6.2 scaffold new
dirs, T-6.3 write scripts/verify_phase06.sh at top-level, T-6.4 rewrite
README + .gitignore
- Wave 2 (frontend-engineer): T-6.5 confirm demo/evidence-ui/ moved
cleanly (confirm-only)
- Wave 3 (lead-developer): T-6.6 run verify_phase06.sh + typecheck gate
Key design: v1.1 verify scripts live at a new top-level scripts/ (not
demo/scripts/ which holds the archived v1.0 verify scripts). All git mv
commands enumerated verbatim in T-6.1, cross-checked against RESEARCH.md
TARGET 10.
2026-07-21 18:26:24 +00:00
288607b3fa
docs(specify): ingest docs/vision+architecture; reframe .ciagent for v1.1
...
---ci---
project: acdl
phase: 0
milestone: v1.1
status: specify
decisions:
- D-034 temporary long-lived AWS key waiver (used once in Phase 08, rotated)
- D-035 milestone v1.1 (feature), ship tag v1.2.0
- D-036 spike picks l1-s3 + l2-static-asset
- D-037 demo archived to demo/
- D-038 open decisions resolved (accept recommendations + decide rest)
---/ci---
Ingest docs/vision.md (6 tenets, anti-goals, signals of success) and
docs/architecture.md v0.2 (4 layers + 6 cross-cutting concerns incl. the
substrate abstraction) as the source of truth for why/how. Reframe the
project from the v1.0 stub demo (tag v1.1.0, archived to demo/ in Phase 06)
to the real Agentic Cloud Delivery Platform.
- config.json: milestone v1.1, status specify
- PROJECT.md: vision + 4-layer/6-concern model + 11 open-decision
resolutions (W1.A/B, W2.A, BA.A accepted; W3.D/E, BA.B-F, OpenTofu
decided) + D-034..D-038
- ARCHITECTURE.md: target architecture (IR, confidence, ledger, HITL, SoD,
substrate abstraction) + v1.1 spike scope (l1-s3 + l2-static-asset)
- REQUIREMENTS.md: add REQ-16..REQ-28 + traceability
- ROADMAP.md: add v1.1 Phases 06-10 (archive, arch-finalize, OIDC, IR+L1,
L2+contract-e2e)
- PERSONAS.md: add platform-engineer + security-engineer (custom),
retire infra-stub-engineer, update territories + verification toolchain
(terraform validate + jsonschema)
- PLAN.md: v1.1 specify plan
2026-07-21 17:55:09 +00:00
grimacing
0672edfc3f
ship: phase-05 evidence-ui-and-demo-dry-run (v1.0.5)
...
Squash merge of phase/05-evidence-ui-and-demo-dry-run; evidence-ui/index.html + run_demo.sh 4-act simulation + verify_phase05.sh; demo live at acdl-evidence raw URL.
2026-07-21 13:53:54 +00:00
grimacing
72b359c9a9
ship: phase-04 pipeline-and-approval-gates (v1.0.4)
...
Squash merge of phase/04-pipeline-and-approval-gates; pipeline.yml + issue-to-contract.yml + finalize_evidence.py; verify_phase04.sh green; 1 P0 fixed (shell injection).
2026-07-21 13:42:25 +00:00
grimacing
3ea36ef3ab
ship: phase-03 l2-modules-and-core-scripts (v1.0.3)
...
Squash merge of phase/03-l2-modules-and-core-scripts; 4 L2s + 5 core scripts; verify_phase03.sh green.
2026-07-21 13:32:21 +00:00
grimacing
00d0043866
ship: phase-02 l1-modules (v1.0.2)
...
Squash merge of phase/02-l1-modules into milestone/v1.0-initial; 8 L1 stub modules created; verify_phase02.sh green.
2026-07-21 13:18:12 +00:00
38eaec9337
docs(P01): create 3-wave phase plan (REQ-01/09/10)
...
---ci---
phase: 1
milestone: v1.0
status: plan
plan:
waves: 3
wave_1_coordination: [T-1.1 gitignore+layout+README, T-1.2 verify_phase01.sh]
wave_2_backend: [T-2.1 gitea_setup.sh, T-2.2 pipeline.yml skeleton, T-2.3 issue-to-contract.yml skeleton]
wave_3_coordination: [T-3.1 wire verify + traceability update]
requirements_covered: [REQ-01, REQ-09, REQ-10]
must_haves: 6
verification:
typecheck: bash -n scripts/*.sh
test: scripts/verify_phase01.sh
build: no-op
---/ci---
PLAN.md defines 3 vertical-slice waves: coordination (skeleton + verify
script), backend (Gitea setup + workflow skeletons), coordination (wiring +
traceability). infra-stub-engineer and frontend-engineer have 0 tasks this
phase. Branch for EXECUTE will be phase/01-repo-scaffolding.
2026-07-21 12:59:27 +00:00
Jon Chery
grimacing